TikTok Acknowledges Zero-Day Exploit Allowing Account Takeovers

Key Points

• TikTok has confirmed a security issue that has been exploited by threat actors to hijack high-profile accounts on the platform.
• The attack involves a zero-click account takeover campaign where malware is propagated via direct messages, allowing attackers to compromise accounts without user interaction.
• TikTok claims the attack only affected a “very small” number of users and has taken preventive measures to stop it from happening again.
• The company is working with affected account holders to restore access but did not provide details about the nature of the attack or mitigation techniques.

Security Incidents and Concerns

TikTok has faced several security issues in the past, including vulnerabilities that could have allowed attackers to build a database of users and their phone numbers, as well as a one-click exploit affecting the Android app.

Additionally, thousands of TikTok accounts in Turkey were compromised last year due to insecure SMS routing, enabling adversaries to intercept one-time passwords and gain account access.

Bad actors have also leveraged TikTok’s Invisible Challenge to deliver information-stealing malware, highlighting the app’s potential as a vector for malware distribution.

TikTok’s Chinese roots have raised concerns about the app being used for data collection and propaganda dissemination, leading to calls for banning the app in various countries, including the United States.

Legal Challenges and Global Bans

In response to the potential ban in the U.S., TikTok has filed a lawsuit challenging the act, stating it’s an “extraordinary intrusion on free speech rights” and that the U.S. has put forth only “speculative concerns” to justify the ban.

Several nations, including India, Nepal, Senegal, Somalia, and Kyrgyzstan, have already imposed bans on TikTok, while others, such as the U.S., U.K., Canada, Australia, and New Zealand, have barred the app’s use on government devices.